x.comthreadRicardo Arguello (@RicardoIQSource) on X
Post by RicardoIQSource on breaches of developer platforms aimed at AI provider keys. It reports OpenCode (17 October, provider keys in its Console) and Zeabur (14-15 October, 3.2M environment variable records, admin tokens stored in plaintext since January 2024) as following the Railway incident. It claims three platforms were hit in eight days and links a blog with a timeline and remediation steps.
TL;DR Links three developer-platform breaches in eight days (Railway, OpenCode, Zeabur) that targeted stored AI provider keys and environment variables.
Organisations named here
- plaintext admin tokens
- Zeabur breach
Technologies named here
- OpenCode
- Zeabur
- Railway
Techniques named here
- Plaintext storage of admin tokens
Related in Threat Intel
huntress.comwriteupReverse Engineering the Six Stages of MacSync Stealer and RAT
huntress.comwriteupAI-Coded Malware | Analyzing Vibe-Coded AD Enumeration | Huntress
blog.talosintelligence.comtoolIntroducing CAIRN: Frontier tracking for AI-integrated malware (Cisco Talos)
huntress.comwriteup